CVE-2026-78599: Kibana Fleet Path Traversal Vulnerability

CVE-2026-78599 Overview

CVE-2026-78599 is a path traversal vulnerability [CWE-22] in the Kibana Fleet feature. A low-privileged user with Fleet write access can craft input that causes a subsequent administrative delete action to target unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface, which limits standalone abuse but enables a two-step attack chain. Elastic addressed the issue in Kibana 8.19.18 and 9.4.3 under advisory ESA-2026-157.

Critical Impact
Unauthorized deletion of internal Kibana Fleet resources can disrupt fleet-managed agents, integrations, and policies, producing availability loss across monitored infrastructure.

Affected Products

Kibana Fleet feature (Elastic Stack)
Kibana versions prior to 8.19.18
Kibana versions prior to 9.4.3

Discovery Timeline

2026-09-02 - CVE-2026-78599 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78599

Vulnerability Analysis

The vulnerability resides in how the Kibana Fleet feature handles pathname input when preparing resources for administrative actions. Fleet does not sufficiently constrain pathnames to their intended directory scope. A user with Fleet write privileges can supply crafted path components that traverse beyond the intended resource boundary. When an administrator later performs a delete action, the operation resolves to an internal resource the attacker selected rather than the resource the administrator intended to remove.

The attack maps to CAPEC-126 (Path Traversal). The confidentiality and integrity impacts are rated none in the CVSS vector, but the availability impact is high. Deleting internal resources can break Fleet-managed agent policies, integrations, or configuration objects that other components rely on.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory within the Fleet component. Fleet accepts identifier or path input from a low-privileged writer and does not normalize or validate that the resolved path stays within the expected resource namespace. The delete operation trusts this resolved path when an administrator triggers it, producing a confused deputy condition.

Attack Vector

Exploitation is network-based and requires an authenticated user with Fleet write access. The attacker plants a malicious resource entry containing traversal sequences through the Fleet interface or its API. Exploitation then depends on an administrator interacting with the affected Fleet interface and initiating a delete action. When the administrator confirms deletion, the backend resolves the tampered pathname and removes an unintended internal resource. No end-user interaction outside the administrative workflow is required.

No public proof-of-concept exploit is available at the time of publication. Technical detail is described in prose only per verified data. See the Elastic Security Update ESA-2026-157 for vendor context.

Detection Methods for CVE-2026-78599

Indicators of Compromise

Fleet resource names or identifiers containing traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute path fragments.
Unexpected deletions of Fleet policies, integrations, agent configurations, or saved objects with no corresponding administrator change ticket.
Fleet write API calls from low-privileged accounts immediately preceding an administrator delete action.

Detection Strategies

Audit Kibana audit.log for Fleet write operations by non-administrative users, correlating them with subsequent delete events performed by admins.
Inspect Fleet resource metadata for identifiers that contain path separators or encoded traversal characters, which should never appear in legitimate names.
Alert on delete actions that affect internal system resources rather than user-created Fleet objects.

Monitoring Recommendations

Forward Kibana audit logs and Elasticsearch security events to a centralized logging platform for retention and correlation.
Monitor Fleet agent policy inventories for unexpected reductions in policy count or missing integrations.
Track administrator sessions that perform Fleet delete operations shortly after non-administrator write events from the same tenant.

How to Mitigate CVE-2026-78599

Immediate Actions Required

Upgrade Kibana to version 8.19.18 or 9.4.3 or later, as directed in ESA-2026-157.
Review current holders of Fleet write privileges and revoke access for accounts that do not require it.
Audit recent Fleet resource creations and modifications for identifiers containing suspicious path characters.

Patch Information

Elastic released fixes in Kibana 8.19.18 and 9.4.3. Refer to the Elastic Security Update ESA-2026-157 for release notes and upgrade guidance. Apply the patched version to all Kibana nodes in the cluster.

Workarounds

Restrict Fleet write access to trusted administrative accounts until patching completes.
Instruct administrators to avoid using the affected Fleet delete workflows on resources created or modified by low-privileged users until the upgrade is applied.
Enable and review Kibana audit logging so that any exploitation attempts leave a forensic trail.

bash

# Verify Kibana version and confirm patched release
curl -s -u "$KIBANA_USER:$KIBANA_PASS" \
  "https://kibana.example.com:5601/api/status" \
  | jq '.version.number'

# Expected output: 8.19.18 or 9.4.3 (or later)